deploy-hf-space.yml

name: Deploy verified LibreFS HFS wrapper

on:
  workflow_dispatch:
    inputs:
      target:
        description: "Manifest-owned deployment target"
        required: true
        default: candidate
        type: choice
        options: [candidate, production]
      confirm_release:
        description: "Type RELEASE to confirm the Space write"
        required: true
        type: string
      librefs_commit:
        description: "Immutable 40-character lowercase libreFS commit already configured in Space Variables"
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: librefs-hfs-space-release
  cancel-in-progress: false

env:
  FORMAL_SPACE: BlueSkyXN/libreFS-HFS
  HF_CLI_VERSION: "1.5.0"
  HF_CLI_CLICK_VERSION: "8.3.3"

jobs:
  deploy:
    if: ${{ inputs.confirm_release == 'RELEASE' }}
    runs-on: ubuntu-24.04
    environment: ${{ inputs.target == 'candidate' && 'hfs-candidate' || 'hfs-production' }}
    steps:
      - name: Check out the immutable wrapper commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 1

      - name: Validate release inputs and configured source pin
        env:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
          LIBREFS_COMMIT: ${{ inputs.librefs_commit }}
          HFS_MANIFEST: ${{ inputs.target == 'candidate' && 'hfs-dev.candidate.toml' || 'hfs-dev.toml' }}
        run: |
          set -Eeuo pipefail
          [[ "$LIBREFS_COMMIT" =~ ^[0-9a-f]{40}$ ]]
          SPACE_ID="$(python3 -c 'import os,tomllib; print(tomllib.load(open(os.environ["HFS_MANIFEST"], "rb"))["space"])')"
          echo "SPACE_ID=$SPACE_ID" >> "$GITHUB_ENV"
          echo "LIBREFS_COMMIT=$LIBREFS_COMMIT" >> "$GITHUB_ENV"
          python3 -m pip install --disable-pip-version-check \
            "huggingface_hub==${HF_CLI_VERSION}" \
            "click==${HF_CLI_CLICK_VERSION}"
          export SPACE_ID LIBREFS_COMMIT
          HFS_TARGET="${{ inputs.target }}" python3 - <<'PY'
          import os
          from huggingface_hub import HfApi

          if os.environ["HFS_TARGET"] == "production" and os.environ["SPACE_ID"] != os.environ["FORMAL_SPACE"]:
              raise SystemExit("production manifest must select the canonical LibreFS Space")
          api = HfApi(token=os.environ["HF_TOKEN"])
          info = api.space_info(os.environ["SPACE_ID"], expand=["private"])
          if info.private is not True:
              raise SystemExit("target Space must be private before wrapper upload")
          variables = api.get_space_variables(os.environ["SPACE_ID"])
          expected = {
              "LIBREFS_COMMIT": os.environ["LIBREFS_COMMIT"],
              "HFS_RELEASE_BUILD": "true",
          }
          for name, value in expected.items():
              remote = variables.get(name)
              if remote is None or remote.value != value:
                  raise SystemExit(f"configured Space Variable mismatch: {name}")
          PY

      - name: Export and verify the allowlisted Space wrapper
        env:
          HFS_MANIFEST: ${{ inputs.target == 'candidate' && 'hfs-dev.candidate.toml' || 'hfs-dev.toml' }}
        run: |
          set -Eeuo pipefail
          scripts/export-space-bundle.sh \
            --source-commit "$GITHUB_SHA" \
            --librefs-source-commit "$LIBREFS_COMMIT" \
            --manifest "$HFS_MANIFEST" \
            --output "$RUNNER_TEMP/librefs-hfs-space-bundle"
          scripts/verify-space-bundle.sh --bundle "$RUNNER_TEMP/librefs-hfs-space-bundle"

      - name: Refuse a Space repository outside the wrapper boundary
        env:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
        run: |
          set -Eeuo pipefail
          bundle_dir="$RUNNER_TEMP/librefs-hfs-space-bundle"
          preflight_dir="$RUNNER_TEMP/librefs-hfs-space-preflight"
          expected_paths="$(cd "$bundle_dir" && find . -type f -print | LC_ALL=C sort | cut -c3-)"
          if ! python3 -m huggingface_hub.cli.hf download "$SPACE_ID" --repo-type space --local-dir "$preflight_dir" >/dev/null 2>&1; then
            echo "Refusing to upload: unable to read the current Space repository." >&2
            exit 1
          fi
          actual_paths="$(cd "$preflight_dir" && find . -type f ! -path './.cache/huggingface/*' -print | LC_ALL=C sort | cut -c3-)"
          unexpected_paths="$(comm -23 \
            <(printf '%s\n' "$actual_paths") \
            <(printf '%s\n' "$expected_paths"))"
          if [[ -n "$unexpected_paths" ]]; then
            printf '%s\n%s\n' \
              'Refusing to upload: the current Space repository contains files outside the verified wrapper boundary.' \
              'This workflow never deletes legacy files. Migrate to a clean Space repository or perform a separately approved, reviewed cleanup before retrying.' >&2
            printf 'Unexpected path: %s\n' "$unexpected_paths" >&2
            exit 1
          fi

      - name: Upload only the verified wrapper bundle
        env:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
        run: |
          set -Eeuo pipefail
          if [[ "${{ inputs.target }}" == "production" ]]; then
            [[ "$GITHUB_REF" == "refs/heads/main" ]]
            git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
            [[ "$(git rev-parse HEAD)" == "$GITHUB_SHA" ]]
            [[ "$(git rev-parse origin/main)" == "$GITHUB_SHA" ]]
          fi
          python3 -m huggingface_hub.cli.hf upload "$SPACE_ID" "$RUNNER_TEMP/librefs-hfs-space-bundle" . \
            --repo-type space \
            --commit-message "Deploy verified wrapper ${GITHUB_SHA}"

      - name: Read back the complete uploaded wrapper and Space metadata
        env:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
        run: |
          set -Eeuo pipefail
          bundle_dir="$RUNNER_TEMP/librefs-hfs-space-bundle"
          readback_dir="$RUNNER_TEMP/librefs-hfs-space-readback"
          expected_paths="$(cd "$bundle_dir" && find . -type f -print | LC_ALL=C sort | cut -c3-)"
          if ! python3 -m huggingface_hub.cli.hf download "$SPACE_ID" --repo-type space --local-dir "$readback_dir" >/dev/null 2>&1; then
            echo "Unable to read back the uploaded Space repository." >&2
            exit 1
          fi
          actual_paths="$(cd "$readback_dir" && find . -type f ! -path './.cache/huggingface/*' -print | LC_ALL=C sort | cut -c3-)"
          [[ "$actual_paths" == "$expected_paths" ]]
          cmp "$bundle_dir/BUILD_SOURCE.json" "$readback_dir/BUILD_SOURCE.json"
          cmp "$bundle_dir/SHA256SUMS" "$readback_dir/SHA256SUMS"
          (
            cd "$readback_dir"
            sha256sum -c SHA256SUMS
          )
          python3 - <<'PY'
          import os
          import re
          from huggingface_hub import HfApi

          space_id = os.environ["SPACE_ID"]
          info = HfApi(token=os.environ["HF_TOKEN"]).space_info(space_id)
          if info.id != space_id or not re.fullmatch(r"[0-9a-f]{40}", info.sha or ""):
              raise SystemExit("Space metadata readback returned unexpected identity or revision")
          print(f"Space metadata readback succeeded: id={info.id}, sha={info.sha}")
          PY

      - name: Record remaining runtime owner gates
        run: |
          cat <<'EOF'
          Source bundle upload and complete repository readback succeeded. Before
          treating the release as complete, the release and data owners must
          separately read back Space build/runtime status and perform the approved
          health, authenticated S3 smoke, restart/rebuild persistence, backup, and
          isolated-restore checks. This workflow performs none of those actions.
          EOF